This week I talk about examining Windows Service modification events for evidence of persistence.